China: Google attack part of widespread spying effort

Analysts see Google's threat to leave China as a public admission that corporate espionage is troubling US businesses.

Email this to a friend

Characters remaining:

What is A + B?

Google's decision on Tuesday to risk walking away from the world's largest Internet market may have come as a shock, but security experts see it as the most public admission of a top IT problem for U.S. companies: ongoing corporate espionage originating from China.

It's a problem that the U.S. lawmakers have complained about loudly. In the corporate world, online attacks that appear to come from China have been an ongoing problem for years, but big companies haven't said much about this, eager to remain in the good graces of the world's powerhouse economy.

Google, by implying that Beijing had sponsored the attack, has placed itself in the center of an international controversy, exposing what appears to be a state-sponsored corporate espionage campaign that compromised more than 30 technology, financial and media companies, most of them global Fortune 500 enterprises.

The U.S. government is taking the attack seriously. Late Tuesday, U.S. Secretary of State Hillary Clinton released a statement asking the Chinese government to explain itself, saying that Google's allegations "raise very serious concerns and questions."

"The ability to operate with confidence in cyberspace is critical in a modern society and economy," she said.

The search-engine company first learned it had a security problem in mid-December, coincidentally just days after hosting a closed-door symposium on circumventing censorship. Soon the company's security team realised that it was dealing with more than just a few hacked workstations.

"First, this attack was not just on Google. As part of our investigation we have discovered that at least twenty other large companies from a wide range of businesses - including the Internet, finance, technology, media and chemical sectors - have been similarly targeted," wrote Google Chief Legal Officer David Drummond in a Tuesday blog posting.

"Second, we have evidence to suggest that a primary goal of the attackers was accessing the Gmail accounts of Chinese human rights activists."

Drummond said that the hackers never got into Gmail accounts via the Google hack, but they did manage to get some "account information (such as the date the account was created) and subject line."

That's because they apparently were able to access a system used to help Google comply with search warrants by providing data on Google users, said a source familiar with the situation, who spoke on condition of anonymity because he was not authorized to speak with the press.

"Right before Christmas, it was, 'Holy s***, this malware is accessing the internal intercept [systems],'" he said.

That, in turn led to a Christmas Eve meeting led by Google co-founder Larry Page to assess the situation. Three weeks later, the company had decided that things were serious enough that it would risk walking away from the largest market of Internet users in the world.

Drummond, in his blog post, said that -- in part due to this incident -- Google would no longer censor search results in China, a move that could cause its Web site to be blocked by the Chinese government.

Corporate IT workers have come to expect all sorts of Internet attacks from China in recent years, but because of the distributed nature of the Internet, it's very hard to determine the true source of a cyber attack. For several hundred dollars, criminals from any country can buy so-called bulletproof hosting in China. These servers are guaranteed not to be taken down, even if they are linked to spam or other illegal online activity.

In this case, however, Google believes the attacks really were state sponsored, said Leslie Harris, president and CEO of the Center for Democracy and Technology. "They wouldn't be taking an action suggesting that they cannot operate in China ... if it was not related to the Chinese government," she said.

Google's security team eventually managed to gain access to a server that was used to control the hacked systems, and discovered that it was not the only company to be hit. In fact, 33 other companies had also been compromised, including Adobe Systems, according to several sources familiar with the situation.